Okta OAuth2
| eventType | Description | Sample | Rule |
|---|---|---|---|
| oauth2. | Authorization server is activated. | Y | N |
| oauth2. | Authorization server is created. | Y | N |
| oauth2. | Authorization server is deactivated. | Y | N |
| oauth2. | Authorization server is deleted. | Y | N |
| oauth2. | Authorization server is updated. | N | N |
| oauth2. | OAuth2 claim is created. | Y | N |
| oauth2. | OAuth2 claim is deleted. | Y | N |
| oauth2. | OAuth2 claim is updated. | Y | N |
| oauth2. | OAuth2 scope is created. | Y | N |
| oauth2. | OAuth2 scope is deleted. | Y | N |
| oauth2. | OAuth2 scope is updated. | Y | N |
oauth2.as.activated
#Description
Authorization server is activated.
Example System Log Event #
{
"actor": {
"id": "00u00000000000000002",
"type": "User",
"alternateId": "user02@dw-harness.example",
"displayName": "DW Harness 02",
"detailEntry": null
},
"client": {
"userAgent": {
"rawUserAgent": "python-requests/2.34.2",
"os": "Unknown",
"browser": "UNKNOWN"
},
"zone": "null",
"device": "Unknown",
"id": null,
"ipAddress": "198.51.100.2",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
}
},
"device": null,
"authenticationContext": {
"authenticationProvider": null,
"credentialProvider": null,
"credentialType": null,
"issuer": null,
"interface": null,
"authenticationStep": 0,
"rootSessionId": "trs00000000000000077",
"externalSessionId": "trs00000000000000077"
},
"displayMessage": "Authorization server is activated.",
"eventType": "oauth2.as.activated",
"outcome": {
"result": "SUCCESS",
"reason": null
},
"published": "2026-07-24T03:47:56.972Z",
"securityContext": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com",
"isProxy": false,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
},
"severity": "INFO",
"debugContext": {
"debugData": {
"requestId": "00000000000000000000000000000090",
"dtHash": "0000000000000000000000000000000000000000000000000000000000000002",
"requestUri": "/api/v1/authorizationServers/aus00000000000000075/lifecycle/activate",
"defaultAuthorizationServer": "false",
"url": "/api/v1/authorizationServers/aus00000000000000075/lifecycle/activate?"
}
},
"gatewayContext": null,
"legacyEventType": "api.oauth2.as.activated",
"transaction": {
"type": "WEB",
"id": "00000000000000000000000000000090",
"detail": {
"rootApiTokenId": "00T00000000000000004",
"requestApiTokenId": "00T00000000000000004"
}
},
"uuid": "00000000-0000-0000-0000-000000000104",
"version": "0",
"request": {
"ipChain": [
{
"ip": "198.51.100.2",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
},
"version": "V4",
"source": null,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
}
]
},
"target": [
{
"id": "aus00000000000000075",
"type": "AuthorizationServerEntity",
"alternateId": "user03@dw-harness.example",
"displayName": "DW Harness 35",
"detailEntry": {
"authorizationserverdescription": "dw harness throwaway authorization server"
}
}
]
}
References #
oauth2.as.created
#Description
Authorization server is created.
Example System Log Event #
{
"actor": {
"id": "00u00000000000000002",
"type": "User",
"alternateId": "user02@dw-harness.example",
"displayName": "DW Harness 02",
"detailEntry": null
},
"client": {
"userAgent": {
"rawUserAgent": "python-requests/2.34.2",
"os": "Unknown",
"browser": "UNKNOWN"
},
"zone": "null",
"device": "Unknown",
"id": null,
"ipAddress": "198.51.100.2",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
}
},
"device": null,
"authenticationContext": {
"authenticationProvider": null,
"credentialProvider": null,
"credentialType": null,
"issuer": null,
"interface": null,
"authenticationStep": 0,
"rootSessionId": "trs00000000000000074",
"externalSessionId": "trs00000000000000074"
},
"displayMessage": "Authorization server is created.",
"eventType": "oauth2.as.created",
"outcome": {
"result": "SUCCESS",
"reason": null
},
"published": "2026-07-24T03:47:55.584Z",
"securityContext": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com",
"isProxy": false,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
},
"severity": "INFO",
"debugContext": {
"debugData": {
"requestId": "00000000000000000000000000000088",
"dtHash": "0000000000000000000000000000000000000000000000000000000000000002",
"requestUri": "/api/v1/authorizationServers",
"defaultAuthorizationServer": "false",
"url": "/api/v1/authorizationServers?"
}
},
"gatewayContext": null,
"legacyEventType": "api.oauth2.as.created",
"transaction": {
"type": "WEB",
"id": "00000000000000000000000000000088",
"detail": {
"rootApiTokenId": "00T00000000000000004",
"requestApiTokenId": "00T00000000000000004"
}
},
"uuid": "00000000-0000-0000-0000-000000000102",
"version": "0",
"request": {
"ipChain": [
{
"ip": "198.51.100.2",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
},
"version": "V4",
"source": null,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
}
]
},
"target": [
{
"id": "aus00000000000000075",
"type": "AuthorizationServerEntity",
"alternateId": "user03@dw-harness.example",
"displayName": "DW Harness 35",
"detailEntry": {
"authorizationserverdescription": "dw harness throwaway authorization server"
}
}
]
}
References #
oauth2.as.deactivated
#Description
Authorization server is deactivated.
Example System Log Event #
{
"actor": {
"id": "00u00000000000000002",
"type": "User",
"alternateId": "user02@dw-harness.example",
"displayName": "DW Harness 02",
"detailEntry": null
},
"client": {
"userAgent": {
"rawUserAgent": "python-requests/2.34.2",
"os": "Unknown",
"browser": "UNKNOWN"
},
"zone": "null",
"device": "Unknown",
"id": null,
"ipAddress": "198.51.100.2",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
}
},
"device": null,
"authenticationContext": {
"authenticationProvider": null,
"credentialProvider": null,
"credentialType": null,
"issuer": null,
"interface": null,
"authenticationStep": 0,
"rootSessionId": "trs00000000000000076",
"externalSessionId": "trs00000000000000076"
},
"displayMessage": "Authorization server is deactivated.",
"eventType": "oauth2.as.deactivated",
"outcome": {
"result": "SUCCESS",
"reason": null
},
"published": "2026-07-24T03:47:56.848Z",
"securityContext": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com",
"isProxy": false,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
},
"severity": "INFO",
"debugContext": {
"debugData": {
"requestId": "00000000000000000000000000000089",
"dtHash": "0000000000000000000000000000000000000000000000000000000000000002",
"requestUri": "/api/v1/authorizationServers/aus00000000000000075/lifecycle/deactivate",
"defaultAuthorizationServer": "false",
"url": "/api/v1/authorizationServers/aus00000000000000075/lifecycle/deactivate?"
}
},
"gatewayContext": null,
"legacyEventType": "api.oauth2.as.deactivated",
"transaction": {
"type": "WEB",
"id": "00000000000000000000000000000089",
"detail": {
"rootApiTokenId": "00T00000000000000004",
"requestApiTokenId": "00T00000000000000004"
}
},
"uuid": "00000000-0000-0000-0000-000000000103",
"version": "0",
"request": {
"ipChain": [
{
"ip": "198.51.100.2",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
},
"version": "V4",
"source": null,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
}
]
},
"target": [
{
"id": "aus00000000000000075",
"type": "AuthorizationServerEntity",
"alternateId": "user03@dw-harness.example",
"displayName": "DW Harness 35",
"detailEntry": {
"authorizationserverdescription": "dw harness throwaway authorization server"
}
}
]
}
References #
oauth2.as.deleted
#Description
Authorization server is deleted.
Example System Log Event #
{
"actor": {
"id": "00u00000000000000002",
"type": "User",
"alternateId": "user02@dw-harness.example",
"displayName": "DW Harness 02",
"detailEntry": null
},
"client": {
"userAgent": {
"rawUserAgent": "python-requests/2.34.2",
"os": "Unknown",
"browser": "UNKNOWN"
},
"zone": "null",
"device": "Unknown",
"id": null,
"ipAddress": "198.51.100.2",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
}
},
"device": null,
"authenticationContext": {
"authenticationProvider": null,
"credentialProvider": null,
"credentialType": null,
"issuer": null,
"interface": null,
"authenticationStep": 0,
"rootSessionId": "trs00000000000000078",
"externalSessionId": "trs00000000000000078"
},
"displayMessage": "Authorization server is deleted.",
"eventType": "oauth2.as.deleted",
"outcome": {
"result": "SUCCESS",
"reason": null
},
"published": "2026-07-24T03:47:57.269Z",
"securityContext": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com",
"isProxy": false,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
},
"severity": "INFO",
"debugContext": {
"debugData": {
"requestId": "00000000000000000000000000000091",
"dtHash": "0000000000000000000000000000000000000000000000000000000000000002",
"requestUri": "/api/v1/authorizationServers/aus00000000000000075",
"defaultAuthorizationServer": "false",
"url": "/api/v1/authorizationServers/aus00000000000000075?"
}
},
"gatewayContext": null,
"legacyEventType": "api.oauth2.as.deleted",
"transaction": {
"type": "WEB",
"id": "00000000000000000000000000000091",
"detail": {
"rootApiTokenId": "00T00000000000000004",
"requestApiTokenId": "00T00000000000000004"
}
},
"uuid": "00000000-0000-0000-0000-000000000105",
"version": "0",
"request": {
"ipChain": [
{
"ip": "198.51.100.2",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
},
"version": "V4",
"source": null,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
}
]
},
"target": [
{
"id": "aus00000000000000075",
"type": "AuthorizationServerEntity",
"alternateId": "user03@dw-harness.example",
"displayName": "DW Harness 35",
"detailEntry": {
"authorizationserverdescription": "dw harness throwaway authorization server"
}
}
]
}
References #
oauth2.claim.created
#Description
OAuth2 claim is created.
Example System Log Event #
{
"actor": {
"id": "00u00000000000000002",
"type": "User",
"alternateId": "user02@dw-harness.example",
"displayName": "DW Harness 02",
"detailEntry": null
},
"client": {
"userAgent": {
"rawUserAgent": "python-requests/2.34.2",
"os": "Unknown",
"browser": "UNKNOWN"
},
"zone": "null",
"device": "Unknown",
"id": null,
"ipAddress": "198.51.100.2",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
}
},
"device": null,
"authenticationContext": {
"authenticationProvider": null,
"credentialProvider": null,
"credentialType": null,
"issuer": null,
"interface": null,
"authenticationStep": 0,
"rootSessionId": "trs00000000000000007",
"externalSessionId": "trs00000000000000007"
},
"displayMessage": "OAuth2 claim is created.",
"eventType": "oauth2.claim.created",
"outcome": {
"result": "SUCCESS",
"reason": null
},
"published": "2026-07-25T23:21:49.585Z",
"securityContext": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com",
"isProxy": false,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
},
"severity": "INFO",
"debugContext": {
"debugData": {
"requestId": "00000000000000000000000000000005",
"dtHash": "0000000000000000000000000000000000000000000000000000000000000002",
"requestUri": "/api/v1/authorizationServers/aus00000000000000003/claims",
"url": "/api/v1/authorizationServers/aus00000000000000003/claims?"
}
},
"gatewayContext": null,
"legacyEventType": "api.oauth2.claim.created",
"transaction": {
"type": "WEB",
"id": "00000000000000000000000000000005",
"detail": {
"rootApiTokenId": "00T00000000000000004",
"requestApiTokenId": "00T00000000000000004"
}
},
"uuid": "00000000-0000-0000-0000-000000000005",
"version": "0",
"request": {
"ipChain": [
{
"ip": "198.51.100.2",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
},
"version": "V4",
"source": null,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
}
]
},
"target": [
{
"id": "ocl00000000000000008",
"type": "OAuth2ClaimEntity",
"alternateId": "user03@dw-harness.example",
"displayName": "DW Harness 05",
"detailEntry": {
"authorizationserverid": "aus00000000000000003",
"oauth2claimclaimtype": "RESOURCE",
"oauth2claimvalue": "\"created\"",
"oauth2claimsystem": "false",
"oauth2claimvaluetype": "EXPRESSION"
}
}
]
}
References #
oauth2.claim.deleted
#Description
OAuth2 claim is deleted.
Example System Log Event #
{
"actor": {
"id": "00u00000000000000002",
"type": "User",
"alternateId": "user02@dw-harness.example",
"displayName": "DW Harness 02",
"detailEntry": null
},
"client": {
"userAgent": {
"rawUserAgent": "python-requests/2.34.2",
"os": "Unknown",
"browser": "UNKNOWN"
},
"zone": "null",
"device": "Unknown",
"id": null,
"ipAddress": "198.51.100.2",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
}
},
"device": null,
"authenticationContext": {
"authenticationProvider": null,
"credentialProvider": null,
"credentialType": null,
"issuer": null,
"interface": null,
"authenticationStep": 0,
"rootSessionId": "trs00000000000000009",
"externalSessionId": "trs00000000000000009"
},
"displayMessage": "OAuth2 claim is deleted.",
"eventType": "oauth2.claim.deleted",
"outcome": {
"result": "SUCCESS",
"reason": null
},
"published": "2026-07-25T23:21:50.099Z",
"securityContext": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com",
"isProxy": false,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
},
"severity": "INFO",
"debugContext": {
"debugData": {
"requestId": "00000000000000000000000000000007",
"dtHash": "0000000000000000000000000000000000000000000000000000000000000002",
"requestUri": "/api/v1/authorizationServers/aus00000000000000003/claims/ocl00000000000000008",
"url": "/api/v1/authorizationServers/aus00000000000000003/claims/ocl00000000000000008?"
}
},
"gatewayContext": null,
"legacyEventType": "api.oauth2.claim.deleted",
"transaction": {
"type": "WEB",
"id": "00000000000000000000000000000007",
"detail": {
"rootApiTokenId": "00T00000000000000004",
"requestApiTokenId": "00T00000000000000004"
}
},
"uuid": "00000000-0000-0000-0000-000000000007",
"version": "0",
"request": {
"ipChain": [
{
"ip": "198.51.100.2",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
},
"version": "V4",
"source": null,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
}
]
},
"target": [
{
"id": "ocl00000000000000008",
"type": "OAuth2ClaimEntity",
"alternateId": "user03@dw-harness.example",
"displayName": "DW Harness 05",
"detailEntry": {
"authorizationserverid": "aus00000000000000003",
"oauth2claimclaimtype": "RESOURCE",
"oauth2claimvalue": "\"updated\"",
"oauth2claimsystem": "false",
"oauth2claimvaluetype": "EXPRESSION"
}
}
]
}
References #
oauth2.claim.updated
#Description
OAuth2 claim is updated.
Example System Log Event #
{
"actor": {
"id": "00u00000000000000002",
"type": "User",
"alternateId": "user02@dw-harness.example",
"displayName": "DW Harness 02",
"detailEntry": null
},
"client": {
"userAgent": {
"rawUserAgent": "python-requests/2.34.2",
"os": "Unknown",
"browser": "UNKNOWN"
},
"zone": "null",
"device": "Unknown",
"id": null,
"ipAddress": "198.51.100.2",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
}
},
"device": null,
"authenticationContext": {
"authenticationProvider": null,
"credentialProvider": null,
"credentialType": null,
"issuer": null,
"interface": null,
"authenticationStep": 0,
"rootSessionId": "0000000000000000000000004",
"externalSessionId": "0000000000000000000000004"
},
"displayMessage": "OAuth2 claim is updated.",
"eventType": "oauth2.claim.updated",
"outcome": {
"result": "SUCCESS",
"reason": null
},
"published": "2026-07-25T23:21:49.844Z",
"securityContext": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com",
"isProxy": false,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
},
"severity": "INFO",
"debugContext": {
"debugData": {
"requestId": "00000000000000000000000000000006",
"dtHash": "0000000000000000000000000000000000000000000000000000000000000002",
"requestUri": "/api/v1/authorizationServers/aus00000000000000003/claims/ocl00000000000000008",
"url": "/api/v1/authorizationServers/aus00000000000000003/claims/ocl00000000000000008?"
}
},
"gatewayContext": null,
"legacyEventType": "api.oauth2.claim.updated",
"transaction": {
"type": "WEB",
"id": "00000000000000000000000000000006",
"detail": {
"rootApiTokenId": "00T00000000000000004",
"requestApiTokenId": "00T00000000000000004"
}
},
"uuid": "00000000-0000-0000-0000-000000000006",
"version": "0",
"request": {
"ipChain": [
{
"ip": "198.51.100.2",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
},
"version": "V4",
"source": null,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
}
]
},
"target": [
{
"id": "ocl00000000000000008",
"type": "OAuth2ClaimEntity",
"alternateId": "user03@dw-harness.example",
"displayName": "DW Harness 05",
"detailEntry": {
"authorizationserverid": "aus00000000000000003",
"oauth2claimclaimtype": "RESOURCE",
"oauth2claimvalue": "\"updated\"",
"oauth2claimsystem": "false",
"oauth2claimvaluetype": "EXPRESSION"
}
}
]
}
References #
oauth2.scope.created
#Description
OAuth2 scope is created.
Example System Log Event #
{
"actor": {
"id": "00u00000000000000002",
"type": "User",
"alternateId": "user02@dw-harness.example",
"displayName": "DW Harness 02",
"detailEntry": null
},
"client": {
"userAgent": {
"rawUserAgent": "python-requests/2.34.2",
"os": "Unknown",
"browser": "UNKNOWN"
},
"zone": "null",
"device": "Unknown",
"id": null,
"ipAddress": "198.51.100.2",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
}
},
"device": null,
"authenticationContext": {
"authenticationProvider": null,
"credentialProvider": null,
"credentialType": null,
"issuer": null,
"interface": null,
"authenticationStep": 0,
"rootSessionId": "0000000000000000000000002",
"externalSessionId": "0000000000000000000000002"
},
"displayMessage": "OAuth2 scope is created.",
"eventType": "oauth2.scope.created",
"outcome": {
"result": "SUCCESS",
"reason": null
},
"published": "2026-07-25T23:21:49.016Z",
"securityContext": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com",
"isProxy": false,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
},
"severity": "INFO",
"debugContext": {
"debugData": {
"requestId": "00000000000000000000000000000002",
"dtHash": "0000000000000000000000000000000000000000000000000000000000000002",
"requestUri": "/api/v1/authorizationServers/aus00000000000000003/scopes",
"url": "/api/v1/authorizationServers/aus00000000000000003/scopes?"
}
},
"gatewayContext": null,
"legacyEventType": "api.oauth2.scope.created",
"transaction": {
"type": "WEB",
"id": "00000000000000000000000000000002",
"detail": {
"rootApiTokenId": "00T00000000000000004",
"requestApiTokenId": "00T00000000000000004"
}
},
"uuid": "00000000-0000-0000-0000-000000000002",
"version": "0",
"request": {
"ipChain": [
{
"ip": "198.51.100.2",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
},
"version": "V4",
"source": null,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
}
]
},
"target": [
{
"id": "scp00000000000000005",
"type": "OAuth2ScopeEntity",
"alternateId": "user03@dw-harness.example",
"displayName": "DW Harness 03",
"detailEntry": {
"authorizationserverid": "aus00000000000000003",
"oauth2scopedescription": "dw harness throwaway scope"
}
}
]
}
References #
oauth2.scope.deleted
#Description
OAuth2 scope is deleted.
Example System Log Event #
{
"actor": {
"id": "00u00000000000000002",
"type": "User",
"alternateId": "user02@dw-harness.example",
"displayName": "DW Harness 02",
"detailEntry": null
},
"client": {
"userAgent": {
"rawUserAgent": "python-requests/2.34.2",
"os": "Unknown",
"browser": "UNKNOWN"
},
"zone": "null",
"device": "Unknown",
"id": null,
"ipAddress": "198.51.100.2",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
}
},
"device": null,
"authenticationContext": {
"authenticationProvider": null,
"credentialProvider": null,
"credentialType": null,
"issuer": null,
"interface": null,
"authenticationStep": 0,
"rootSessionId": "trs00000000000000006",
"externalSessionId": "trs00000000000000006"
},
"displayMessage": "OAuth2 scope is deleted.",
"eventType": "oauth2.scope.deleted",
"outcome": {
"result": "SUCCESS",
"reason": null
},
"published": "2026-07-25T23:21:49.489Z",
"securityContext": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com",
"isProxy": false,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
},
"severity": "INFO",
"debugContext": {
"debugData": {
"requestId": "00000000000000000000000000000004",
"dtHash": "0000000000000000000000000000000000000000000000000000000000000002",
"requestUri": "/api/v1/authorizationServers/aus00000000000000003/scopes/scp00000000000000005",
"url": "/api/v1/authorizationServers/aus00000000000000003/scopes/scp00000000000000005?"
}
},
"gatewayContext": null,
"legacyEventType": "api.oauth2.scope.deleted",
"transaction": {
"type": "WEB",
"id": "00000000000000000000000000000004",
"detail": {
"rootApiTokenId": "00T00000000000000004",
"requestApiTokenId": "00T00000000000000004"
}
},
"uuid": "00000000-0000-0000-0000-000000000004",
"version": "0",
"request": {
"ipChain": [
{
"ip": "198.51.100.2",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
},
"version": "V4",
"source": null,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
}
]
},
"target": [
{
"id": "scp00000000000000005",
"type": "OAuth2ScopeEntity",
"alternateId": "user03@dw-harness.example",
"displayName": "DW Harness 04",
"detailEntry": {
"authorizationserverid": "aus00000000000000003",
"oauth2scopedescription": "dw harness throwaway scope"
}
}
]
}
References #
oauth2.scope.updated
#Description
OAuth2 scope is updated.
Example System Log Event #
{
"actor": {
"id": "00u00000000000000002",
"type": "User",
"alternateId": "user02@dw-harness.example",
"displayName": "DW Harness 02",
"detailEntry": null
},
"client": {
"userAgent": {
"rawUserAgent": "python-requests/2.34.2",
"os": "Unknown",
"browser": "UNKNOWN"
},
"zone": "null",
"device": "Unknown",
"id": null,
"ipAddress": "198.51.100.2",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
}
},
"device": null,
"authenticationContext": {
"authenticationProvider": null,
"credentialProvider": null,
"credentialType": null,
"issuer": null,
"interface": null,
"authenticationStep": 0,
"rootSessionId": "0000000000000000000000003",
"externalSessionId": "0000000000000000000000003"
},
"displayMessage": "OAuth2 scope is updated.",
"eventType": "oauth2.scope.updated",
"outcome": {
"result": "SUCCESS",
"reason": null
},
"published": "2026-07-25T23:21:49.248Z",
"securityContext": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com",
"isProxy": false,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
},
"severity": "INFO",
"debugContext": {
"debugData": {
"requestId": "00000000000000000000000000000003",
"dtHash": "0000000000000000000000000000000000000000000000000000000000000002",
"requestUri": "/api/v1/authorizationServers/aus00000000000000003/scopes/scp00000000000000005",
"url": "/api/v1/authorizationServers/aus00000000000000003/scopes/scp00000000000000005?"
}
},
"gatewayContext": null,
"legacyEventType": "api.oauth2.scope.updated",
"transaction": {
"type": "WEB",
"id": "00000000000000000000000000000003",
"detail": {
"rootApiTokenId": "00T00000000000000004",
"requestApiTokenId": "00T00000000000000004"
}
},
"uuid": "00000000-0000-0000-0000-000000000003",
"version": "0",
"request": {
"ipChain": [
{
"ip": "198.51.100.2",
"geographicalContext": {
"city": "Anytown",
"state": "Anystate",
"country": "Placeholderland",
"postalCode": "00000",
"geolocation": {
"lat": 0.0,
"lon": 0.0
}
},
"version": "V4",
"source": null,
"ipDetails": {
"asNumber": 0,
"asOrg": "example-as-org",
"isp": "example-isp",
"domain": "example.com"
}
}
]
},
"target": [
{
"id": "scp00000000000000005",
"type": "OAuth2ScopeEntity",
"alternateId": "user03@dw-harness.example",
"displayName": "DW Harness 04",
"detailEntry": {
"authorizationserverid": "aus00000000000000003",
"oauth2scopedescription": "dw harness throwaway scope"
}
}
]
}